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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibility to promote economy, effectiveness, and efficiency within the department. 

This report addresses the actions DHS has taken to identify Buffer Zone Protection Program assets 
and the adequacy of eligibility criteria used to determine investments at critical infrastructure and 
key resource sites. It is based on interviews with employees and officials of relevant agencies and 
institutions, direct observations, quantitative analysis, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 
have been discussed in draft with those responsible for implementation. It is our hope that this 
report will result in more effective, efficient, and economical operations. We express our 
appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Executive Summary 

The Buffer Zone Protection Program (BZPP) supports the implementation of 
preventive and protective measures outside the perimeter of selected critical 
infrastructure and key resource (CI/KR) sites throughout the United States. 
Buffer zone plans (BZPs) define supplemental security areas outside the 
CI/KR site perimeter and recommend preventive and protective measures 
designed to make it more difficult for terrorists to conduct surveillance or 
launch attacks. The BZPP provides funding to responsible jurisdictions to 
purchase equipment to extend the zone of protection around CI/KR facilities, 
expand preparedness capabilities, and enhance the security of surrounding 
communities. 

The Department of Homeland Security (DHS) has made numerous 
modifications to the program since its inception in 2004 to solve 
administrative challenges stemming from the involvement of multiple 
agencies, co-management of the program within DHS, the complexity of the 
BZP development and submission process, and unclear program requirements. 
These factors, as well as state and local procurement processes and 
procedures, initially slowed the delivery of equipment to responsible 
jurisdictions and have kept spending at a deliberate pace. As of November 
2006, state grantees had expended $19.6 million or 21% of the $91.3 million 
in available funding. As of April 2007, state grantees had expended $36 
million, or 40%. 

Program managers continue to enhance the program and unify efforts to 
protect CI/KR assets and combat terrorism. Accordingly, we resolved all 12 
recommendations to DHS to strengthen the site selection and BZP submission 
process; improve communication among the state agencies, local participants, 
and DHS offices; and, better define roles and responsibilities of the DHS 
offices managing the program. We are closing six recommendations and 
requesting that DHS provide additional evidence of corrective actions taken to 
satisfy the remaining six recommendations. 
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Background 



The Homeland Security Act of 2002 assigned DHS foremost responsibility for 
establishing a national approach and protecting the United States against 
terrorist attacks and other disasters. The 2003 Homeland Security Presidential 
Directive: Critical Infrastructure Identification, Prioritization, and Protection 
(HSPD-7) established a national policy for federal departments and agencies 
to identify and prioritize critical infrastructure and key resource sectors. 
These documents stipulate that DHS work closely with federal departments 
and agencies, state and local governments, and the private sector to produce a 
National Infrastructure Protection Plan that provides an overarching approach 
for integrating CI/KR protection initiatives into a single national effort. Now 
located organizationally under the newly created National Protection and 
Programs Directorate (NPPD), the Office of Infrastructure Protection within 
DHS is responsible for protecting the Nation's critical infrastructure and key 
resources, and for implementing the plan. 1 

Since its inception, DHS has channeled considerable resources to a broad 
range of infrastructure protection activities undertaken at national, state, and 
local levels. In March 2004, the Office of Infrastructure Protection's Risk 
Management Division (RMD) launched the BZPP as a $50 million equipment 
loan program designed to focus terrorism detection and prevention efforts at 
high-priority CI/KR sites. This was done according to the DHS Secretary's 
grant authority in section 102(b)(2) of Homeland Security Act of 2004. The 
Secretary delegated financial assistance authority to the then Under Secretary 
of Information Analysis and Infrastructure Protection on November 13, 2004. 
Responsible jurisdictions selected security equipment to extend the zone of 
protection beyond the gates of facilities such as chemical plants, nuclear 
facilities, dams, and commercial and public facilities (see Figure 1). DHS 
purchased the equipment and loaned it to the responsible jurisdiction for a 1- 
year period. 



See the National Infrastructure Protection Plan and the 17 critical infrastructure and key resource sectors at 
http ://www.dhs .gov/xprevprot/programs/editorial_0827 .shtm. 
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Figure 1 : Aerial View BZPP Site 




Described as a surgical approach to protecting CI/KR, the goal of the BZPP is 
to provide funding for the purchase of equipment that will: 

• Devalue a target by making it less attractive or too costly to attack; 

• Deter an event from happening; 

• Detect an aggressor planning or committing an attack, or the presence 
of a hazardous device or weapon; and 

• Defend against attack by delaying or preventing an aggressor's 
movement toward the asset, or the use of weapons and explosives. 

Initially, the Office of Infrastructure Protection focused efforts on the 1,849 
CI/KR sites known as the Protective Measures Target List and funded each 
site equally at $50,000 per site. It identified BZPP sites in all 50 states, the 
District of Columbia, and three territories. The 1,849 BZPP sites were more 
representative of CI/KR assets from the commercial, chemical/hazardous 
material, and energy sectors, with relatively few sites represented from the 
agriculture and food, emergency services, dams, and telecommunications 
sectors (see Figure 2). To determine appropriate equipment purchases, 
responsible jurisdictions were asked to perform vulnerability assessments of 
each BZPP site. They worked with security personnel and facility managers 
to conduct a vulnerability assessment, identify mitigation equipment, and 
develop a BZP. Following DHS approval of the plan, responsible 



Review of the Buffer Zone Protection Program 
Page 3 



jurisdictions were authorized to select specific equipment, primarily 
surveillance-related. 

Figure 2: BZPP Sites by Sector 

Commercial 



Facilities Ag/Food, dams, 




Transportation Nuclear reactors, Banking & 
Systems materials & waste Finance 2% 



During 2004, RMD staff established and managed the BZP document 
development and submission process, conducted outreach to the state 
homeland security agencies and responsible jurisdictions, and responded to 
the states' site selection concerns. Procurement of the requested security 
equipment was managed under a contract arrangement with the Department of 
Energy's National Energy Technology Lab. Under this arrangement, 38 
responsible jurisdictions received equipment. 

In early 2005, RMD converted the BZPP into a grant program. RMD retained 
responsibility for the technical review and approval of BZPs and equipment 
requested by the responsible jurisdiction in Vulnerability Reduction Purchase 
Plans (VRPP). The Office of Grants and Training (G&T) assumed 
responsibility for executing the grants. In March 2007, the Federal 
Emergency Management Agency's (FEMA) Office of Grants Management 
assumed responsibility for executing the BZPP grant program. Preparedness 
Officers and BZPP program managers within G&T were transitioned to 
FEMA, within the National Preparedness Directorate's Capabilities Division. 
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RMD was reorganized into NPPD's Protective Security Coordination Division 
in March 2007. 

In March 2005, DHS announced the availability of $91.3 million in BZPP 
grant funding to continue efforts to protect areas surrounding the 1,849 CI/KR 
sites originally selected for the program. These funds were the combination 
of $41.3 million remaining from the 2004 equipment loan program and an 
additional $50 million for 2005. 

G&T released the 2006 BZPP Program Guidance and Application Kit in 
September 2006. In January 2007, DHS released the 2007 version, which 
reflects a new emphasis on building and supporting state and local capabilities 
to develop and implement homeland security support programs by adopting 
ongoing DHS national initiatives. Through more focused planning and 
equipment purchases and targeting more specific types and limited numbers of 
CI/KR sites, the 2007 BZPP intends to continue supporting (1) the prevention, 
protection, response and recovery objectives of the National Preparedness 
Goal, and (2) the prevention, detection, and deterrence mission areas of the 
National Infrastructure Protection Plan. 



Results of Review 

DHS is making strides toward meeting its BZPP program goals and 
establishing a unified national effort to protect CI/KR assets and combat 
terrorism. Since the program's inception in 2004, DHS has addressed several 
issues that have inhibited the program including: 

• Determining the type and number of sites to participate; 

• Determining the amount of money to be allotted per site; 

• Defining the method used to assess site vulnerability; 

• Determining the allowable equipment and planning expenditures; 

• Submission and processing of program materials; and, 

• Defining the grant requirements. 

These adjustments are helping the program achieve its intended results. 

We commend RMD for transitioning the 2004 BZPP Equipment Loan 
Program into a grant program under a partnership with G&T. Additionally, 
states and responsible jurisdictions have applauded DHS for providing 
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tangible benefits beyond the provision of protective security equipment. 
Program participants said BZPP has brought federal, state and local entities, 
and the private sector "to the table" on the CI/KR protection issue. The 
program has identified common objectives, stimulated coordination of 
prevention and protection activities, and highlighted the skills and processes 
necessary to assess CI/KR vulnerabilities and recommend protective 
measures. These accomplishments are value-added benefits that were either 
not in place or not functioning well prior to creation of the BZPP program. 

However, as of November 2006, approximately 79% of the $91.3 million 
BZPP grant funds had not yet been expended. As recently as April 2007, 60% 
remained to be drawn down by states for disbursement to responsible 
jurisdictions for equipment purchases. Although program managers have 
initiated improvements in the site selection, BZP development and submission 
process, and have increased funding amounts available to each site, issues 
involving the implementation and administration of the program remain. The 
areas that DHS must continue to improve are the vetting of sites with state 
offices, timely distribution of funds, and the selection of appropriate security 
equipment. DHS must also address the processing and approval of BZPs, 
communication between its sub-components and with program participants, 
and the roles and responsibilities of those sub-components administering the 
program. 



Challenges with Initial Site Selection and Size of Grant Award 

The process of selecting sites delayed BZP submission and approval, proving 
to be the biggest obstacle that program managers faced during early BZPP 
implementation. In addition, the decision to cap funding at $50,000 per site 
dampened responsible jurisdiction interest in the program, led some to drop 
out of the program, and further complicated and delayed grant awards. 
Modifying the program to eliminate those issues was time consuming for 
program managers and frustrating and confusing for grantees. 

RMD Had to Replace Many Selected Sites 

RMD derived the initial 1,849 BZPP sites from the Protective Measures 
Target List developed by DHS at the request of Congress in 2003. RMD 
officials acknowledged that DHS' methodology was simple: it identified 
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assets based on perceived threats and consequences as opposed to a risk-based 
formula. 

In preparation for the BZPP program, RMD began to assemble additional data 
on CI/KR sites during early 2004. However, their method to collect data from 
states and responsible jurisdictions was not well organized. RMD described 
this process as "rushed" and "ad hoc." When issuing data calls, RMD did not 
inform all of the state homeland security offices of specific CI/KR priorities or 
clearly define a potential terrorist target. This confused and delayed the data 
collection process at the state and local level and led to inconsistent results. 
During 2004, 38 jurisdictions responsible for 45 sites received equipment 
under the loan program prior to the transition of the BZPP to a grant program. 
Delays in the procurement process managed by the National Energy 
Technology Laboratory were also an issue in the slow delivery of equipment. 

Some state officials said DHS did not provide sufficient time to verify 
location, jurisdiction, ownership, and other details on the facilities. For 
example, DHS asked California's State Homeland Security Agency to verify 
detailed information from multiple sources for over 250 sites in less than 90 
days. The state agency sent the site list for verification to the responsible 
jurisdictions, which were in turn given 2 weeks to gather data on or visit as 
many as 25 sites in each jurisdiction. 

Program managers selected sites to ensure wide geographic coverage across 
the spectrum of CI/KR. The 2004 site list had a strong focus on commercial 
sites based upon the prevailing threat vector at the time. States and 
responsible jurisdictions questioned how RMD identified and selected sites, 
and did not always concur that the sites RMD chose were CI/KR priorities. 
Each of the states we visited identified: (1) other higher priority sites — dams, 
bridges, and electrical substations — that better met the CI/KR criteria but were 
not included on the BZPP site list, and (2) sites from the original list of 1,849 
that were either non-existent, non-operational, or of questionable significance. 
These included planned but un-built shopping malls, closed chemical plants, 
and seasonal theme parks without large volumes of visitors. One state official 
questioned why a lightly frequented seasonal water park was on the list when 
a large dam near the state capital was not. Another state official questioned 
the rationale for selecting a shopping mall over a water filtration plant that 
provides nearly 50% of the water for the northern region of the state. 
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Throughout 2005, the inclusion of non-existent and questionable sites on the 
BZPP national list compelled states to renegotiate with RMD to replace 
original sites. This was not unreasonable given DHS' limited knowledge of 
these sites, and the inadequacy of the site selection methodology DHS used in 
2004 to select them. However, the negotiation process was time consuming, 
further delaying the BZP and VRPP development and submission process. 
Site substitution took place in all five states in which we conducted our 
fieldwork; one state ultimately replaced 30% of its original BZPP site list. 
The process generally involved a discussion between the state homeland 
security agency and RMD, detailing why the original site was inappropriate 
and what site should be substituted. RMD retained the final approval 
authority. 

Due to insufficient documentation regarding the process and criteria for 
replacing sites, and the number of sites replaced, we were unable to determine 
whether replacement sites met the same standards for selection as those 
originally included in the program, or whether replacement decisions were 
uniform across all states. For instance, with RMD approval, federal 
government facilities were removed from some states' 2005 and 2006 BZPP 
site lists but were represented in other state lists. Some of the responsible 
jurisdictions we visited said that federal sites should be removed from the 
BZPP list because: (1) states do not have jurisdiction over federal property; 
(2) responsible jurisdictions are often not the first emergency response units; 
and (3) responsible jurisdictions do not have ready site access to perform 
vulnerability assessments. 

Although the 2007 BZPP grant guidance includes a prohibition that funds may 
not be used for the improvement of federal government buildings or for other 
activities solely benefiting the federal government, it does not entirely 
preclude responsible jurisdictions from receiving funding to protect a federal 
site. Without clarification that BZP funds may be used to fund federal sites 
that DHS has determined to be eligible for the program state agencies and 
responsible jurisdictions could still become confused about the status of 
federal facilities in the BZPP program. 

Both DHS and state officials have had difficulty tracking the substitution and 
addition of BZPP sites. Preparedness Officers need reliable and up-to-date 
information on the number of outstanding BZPs and VRPPs in order to review 
and approve them efficiently. Preparedness Officers responsible for 
processing in-coming BZPs from the states said they were not always 
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informed when RMD substituted a site. Many Preparedness Officers, as late 
as July 2006, did not have reliable data on the sites RMD had approved for 
their assigned states. Some Preparedness Officers commented that since there 
was no reliable documentation on sites replaced or added by RMD, the only 
way to identify the BZPs still to be submitted was by regular checks with the 
state homeland security agencies. 

There was no formal deadline established for 2005 BZP and VRPP 
submission, which resulted in additional delays. Grant announcements were 
not made until the end of the fiscal year when RMD program managers 
distributed the site list in March 2005 and asked states to submit BZPs and 
VRPPs to G&T by September 30, 2005. However, some states did not finish 
replacing sites and establishing their final site lists until the end of November 
2005. For example, California did not finalize its site list until October 2005. 
The District of Columbia, which DHS authorized to replace approximately 
50% of its original BZPP sites, did not complete its BZPP list until November 
2005. In Illinois, as of June 2006, responsible jurisdictions were still initiating 
BZP and VRPPs for new sites that had been added to the BZPP list. Program 
officials learned from the 2005 process and implemented submission 
deadlines in 2006 and 2007. 

The Size of the Grant Award Limited Equipment Purchases and Dissuaded 
Participants 

Program managers established a maximum allocation of $50,000 per site for 
the BZPP program. Along with implementing protective measures in the 
form of equipment purchases, RMD said its goal was to spread funding to 
many infrastructure sectors and generate wide interest at the local level. 
However, dividing the funds equally had the opposite effect in some states. 

First, awarding responsible jurisdictions $50,000 per site resulted in small 
equipment purchases, which in many instances did little to address the range 
of vulnerabilities identified at many sites. Second, this amount of funding was 
a disincentive to site owners or operators, states, and responsible jurisdictions, 
particularly those with limited resources. The funding was often considered to 
be inadequate for the amount of work required to conduct site vulnerability 
assessments and prepare BZPs. While some responsible jurisdictions with 
multiple sites were able to combine grants to purchase higher cost equipment, 
this option was not available to many jurisdictions with single sites. 
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Some of the smaller responsible jurisdictions lacked the personnel necessary 
to do the site assessments and prepare BZPs, which we estimate, on average, 
took 200 hours per site to complete. Even some of the larger state agencies 
and responsible jurisdictions said they had difficulty identifying available, 
competent staff to take on the required work under the short time frames 
required. In addition, some site owner/operators were concerned about the 
exchange of security-sensitive or proprietary business information. For 
instance, one state estimated that 30 responsible jurisdictions from among the 
89 selected sites did not want to participate and were ultimately replaced with 
other sites. Another state with just eight BZPP sites initially responded that it 
did not have sufficient resources required to meet program requirements, and 
agreed to participate only when RMD announced that it might withdraw 
funds. 

All of the states we visited had one or more sites that were dropped from the 
program due to low interest, and other sites proposed by that state 
subsequently replaced those sites. State officials reported that for any BZPP 
sites where participation was ruled out for whatever reason, RMD allowed the 
state to offer replacement sites. 

Program managers were not prepared for a pervasive "dropout" problem that 
reached 30% in one state we visited. They acknowledged that $50,000 was 
"insufficient motivation for counties to engage in the program at the local 
level with any enthusiasm." They also acknowledged the amount of work 
required to complete site assessments and prepare BZP and VRPP 
submissions. An unfortunate result of BZPP "dropouts" is that CI/KR sites 
that RMD considered high priority assets were abandoned and protective 
measures might still be needed around these locations. Additionally, the 
dropout and replacement issue creates a question as to whether 2004 and 2005 
BZPP grant monies were awarded according to critical infrastructure 
priorities. 

In response, program managers have improved the site selection methodology, 
and they have directed larger amounts of funding to fewer sites. DHS also 
increased allowable administrative and management costs from 3% to 5% of 
the grant award, which should help support the workload required to complete 
site assessments and BZPs. Additionally, program managers addressed site 
owner/operator concerns about the exchange of security sensitive or 
proprietary business information. States may voluntarily submit information 
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contained in a BZP under the Protected Critical Infrastructure Information 
(PCII) Program. 

Many States Have Yet to Disburse BZPP Funds 

The 2005 BZPP grant guidance did not require states to disburse funds within 
a specific timeframe after the grant award date. DHS grant programs usually 
require disbursement of funds within 90 days of the end of the grant's 
performance period. For example, DHS' two largest grant programs, the State 
Homeland Security Grant Program and the Urban Area Security Initiative, 
both require drawdowns to be made within 90 days or less. The revised 2006 
BZPP guidance required that state administrative agencies obligate funds 
within 60 days of the approval notification for the VRPP. Within that 60-day 
timeframe, the state administrative agency must submit a certification that 
funds have been passed through to local units of government. 

DHS awarded $91.3 million to states under the FY 2005 BZPP. As of 
November 2006, states had drawn down 21% of the $91.3 million with 13 
states yet to draw down any funds at all and only one state, Montana - with six 
sites, had completely expended all obligated BZPP funds. As of April 2007, 
approximately 60% of the $91.3 million remained to be drawn down and only 
three states - South Dakota, Wyoming, and Montana - had completely 
expended their obligated amounts. Seven states still have not drawn down 
any BZPP funds as of April 2007. Many responsible jurisdictions are 
frustrated that they have not received funding so they can acquire requested 
equipment. We found two instances where the responsible jurisdiction waited 
more than two years for the state to make funds available for equipment 
originally requested under the 2004 Equipment Loan Program. Some delays 
in drawdown and expenditure can be attributed to the individual states and 
their administrative and procurement processes. Additionally, program 
managers said that delays have occurred because some states or responsible 
jurisdictions have not been proactive in correcting rejected plans and that they 
have waited up to a year or more for requested revisions. 
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We recommend that the Under Secretary for National Protection and 
Programs: 

Recommendation 1: Verify all future BZPP site data with applicable state 
homeland security or equivalent agencies and establish standard procedures 
for the state agencies to substitute BZPP sites. 

Recommendation 2: Ensure that the BZPP grant guidance explicitly states 
that funding may be used to secure buffer zones surrounding federal facilities. 

Recommendation 3: Establish a deadline for processing all remaining 2005 
BZPs. 



DHS Improved its Site Selection Methodology and Funding Approach 

Unlike the 2004 and 2005 BZPP site selection process, RMD applied a more 
comprehensive and risk-based approach to select 2006 BZPP sites. RMD also 
selected fewer sites so that it could allocate more money to higher priority 
sites. Additionally, RMD launched a separate BZPP grant program to 
mitigate vulnerabilities at chemical facilities. 

The 2006 BZPP grant guidance stipulates that selected sites would be "the 
most at-risk critical infrastructure based on an analysis of consequence and 
available vulnerability data." The analysis entails risk calculations for all risk- 
and need-based grant programs directed to states, cities, and select 
infrastructures based on a common, scalable model. RMD employs its 
Terrorism Risk Model to conduct this analysis. The Terrorism Risk Model 
uses consequence, vulnerability, and threat to estimate the relative risk of a 
successful terrorist attack on a given asset. The sum of the risk plus the 
geographic location provides RMD with the Total Risk relative to a state, city, 
port, transit system, or other infrastructure type. 

RMD worked with the federal agencies implementing sector-specific plans in 
support of the National Infrastructure Protection Plan to develop a list of 
BZPP sites for each sector. They also incorporated data collected from the 
states. For the model, RMD employed two types of risk analysis to the sites: 
site-specific and overall risk. The site-specific analysis focused on a site and 
the surrounding area to determine the degree of regional or cross-jurisdictional 
consequence if lost or disrupted. 
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A vulnerability and threat analysis for the site was then conducted to evaluate 
how likely it would be for an attacker to successfully assault the site. Overall 
risk analysis combined asset-based risk and geographically based risk to 
ensure the BZPP reduced risk to a broad array of at-risk assets. Asset-based 
risk is a function of the risk of terrorism to potential targets within a 
geographic area. Geographically based risk is derived from certain prevailing 
attributes or characteristics intrinsic to each geographical area that may 
contribute to its risk of terrorism. Together, asset-based and geographically 
based risk analysis provided an estimate of the total terrorism risk to a given 
region, evaluation of risk to assets within a state, and degree of risk as it 
relates to the unique characteristics of each state. 

The two-pronged approach enabled RMD to divide 2006 BZPP sites into three 
tiers: 

• Tier One consists of sites that RMD determined would have 
"monumental consequence" if attacked, are considered mandatory for 
the program, and are eligible for funding up to $1 million each. 
Although RMD identified approximately 25 sites in the Tier One 
category, only about half will be funded under the 2006 BZPP, as the 
rest were already funded by other DHS grant programs. 

• Tier Two contains sites that RMD determined to be "high- 
consequence" infrastructure within certain sectors, or sites on which 
intelligence has indicated the possibility of an attack. Responsible 
jurisdictions surrounding these sites are eligible for up to $189,000 for 
each site. States will be able to select Tier Two sites for funding from 
a larger, state-specific site list developed by RMD. For example, if a 
state has 20 sites determined by RMD to be eligible for BZPP funds, 
but the program can fund only 8 of the 20, states must choose which 8 
to fund. 

• Tier Three consists of the remaining BZPP sites. For FY 2006, RMD 
has decided to fund approximately 200 Tier One and Two sites, but no 
Tier Three sites. RMD believes a number of Tier Three sites may be 
addressed through funds provided to nearby Tier One and Tier Two 
sites. 
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Some state officials said that during 2005, they were minimally involved in 
the BZPP site identification efforts. RMD officials said that states would 
assist in the selection of 2006 BZPP sites. As promised, RMD employed a 
more consultative and structured approach by permitting states to vet and 
prioritize the sites. RMD's decision to give states more input resulted in the 
inclusion of more priority CI/KR sites. It is important to note that while states 
want to assist DHS with the selection of CI/KR sites, many state homeland 
security agencies have not yet developed a risk assessment framework to 
guide the prioritization and selection of Tier Two BZPP sites. 

Many Tier One and Tier Two sites are chemical facilities. DHS is the sector- 
specific agency responsible for securing the chemical sector. Due to the high- 
risk nature of this sector and the need to focus resources directly at it, DHS 
initiated the Chemical Sector Buffer Zone Grant Program. For 2006, DHS is 
providing an additional $25 million to mitigate vulnerabilities within DHS- 
identified chemical regions. By removing these sites from the general BZPP, 
DHS ensured additional funding for general BZPP sites. DHS will be better 
able to coordinate its resources to protect chemical sector sites. 

We recommend that the Under Secretary for National Protection and 
Programs: 

Recommendation 4: Continue expanding the involvement of all state 
homeland security or equivalent agencies in the identification of potential 
critical infrastructure/key resource sites. 

Thorough Review of Selected Equipment is Needed 

The BZPP equipment selection and approval process was not sufficiently 
documented at the local, state, and DHS levels. This made it difficult to 
determine whether the BZPP grants were adequately aligned with state and 
national efforts, and not duplicative of other funding sources. Additionally, 
BZPs and VRPPs that were completed by responsible jurisdictions usually did 
not list all the equipment required to address site vulnerabilities or convey 
why certain equipment was selected over other equipment options identified 
in the plan. In those instances, there was no assurance that the funded 
equipment was the most appropriate for the identified site vulnerability or the 
needs of the responsible jurisdiction. 
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The Review and Approval Process 



The BZPP is intended to identify vulnerabilities of selected CI/KR assets and 
the protective measures necessary to help responsible jurisdictions protect 
them (see Figure 3). According to the BZPP grant guidance, documented 
reviews by the state agencies and DHS are necessary to certify that the 
selected equipment is the most appropriate for the identified site 
vulnerabilities and will not be duplicated under another funding source. The 
BZP template, section 8.4, requires responsible jurisdictions to document "the 
specific shortfalls in equipment, training, and personnel that detract from 
security capabilities in the buffer zone" and allows them to select up to 
$50,000 in equipment that will mitigate identified vulnerabilities. Program 
managers described BZP and VRPP development as a process that documents 
all existing site vulnerabilities, the measures to increase site security, and the 
selection of the prioritized equipment. Managers required the identification of 
all recommended enhancements to assist responsible jurisdictions seeking to 
leverage their grant to acquire additional equipment or resources. 



Figure 3: Key Steps BZP Development 



f Identify Threats"^ \f Protective ^\ ^/Identify Resources^ ^/Vulnerability Reduction^ 

& Vulnerabilities \ Plan A \ & Needs \ Purchase Plan 

Site assets & t Measures to i All recommended i Select equipment 
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In 2004, DHS authorized responsible jurisdictions to select any type of 
equipment, up to a value of $50,000, considered necessary and appropriate to 
mitigate the vulnerabilities identified in their BZP. In 2005, BZPP program 
managers standardized the equipment identification, selection, and approval 
process and suggested that responsible jurisdictions select equipment from 
these Authorized Equipment List categories: 



• Explosive device mitigation and remediation; 

• Interoperable communications; 

• Detection; 

• Physical security enhancement; and 

• Inspection and screening systems. 
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The Office of Grant Programs now maintains the Authorized Equipment List 
to assist federal, state, and local public safety organizations to identify and 
procure security-related equipment available through DHS grant programs. 
The list consists of 21 equipment categories and offers information on 
available equipment, technologies, certification standards, and agencies using 
the equipment. It contains a description of the item, the item's identifier 
number, and the permissibility of its purchase using DHS grant funds. 

Under the 2005 BZPP grant program procedures, responsible jurisdictions 
completed a VRPP listing the type and cost of equipment needed to protect 
the CI/KR asset, again up to a value of $50,000. DHS automatically approved 
for procurement the equipment requested from the five suggested Authorized 
Equipment List categories, provided the responsible jurisdiction documented 
the need in the BZP. Program managers approved equipment requests from 
other equipment categories on a case-by-case basis. According to the program 
guidance, the state administrative or state homeland security agency reviews 
each BZP and VRPP to determine that equipment and other recommended 
enhancements align with state or urban area strategy goals and will be 
leveraged, as appropriate, with additional resources from other funding 
sources. 

Approval of Equipment Purchases Was Not Well-Documented 

We visited California, Georgia, Illinois, Virginia, and the District of Columbia 
and reviewed 412 BZPs and related documents submitted in 2004 and 2005 by 
the four states. The District of Columbia had not submitted any BZPs and 
VRPPs at that time. While the BZPP Memorandum of Agreement and the 
grant guidance stipulates that states, G&T, and RMD were required to review 
and approve BZPs and VRPPs, neither the states nor the DHS sub- 
components documented their assessments. We were unable to obtain 
sufficient documentation supporting approval of the VRPP at the state- and 
DHS-approval stages and in 100% of the BZPs, neither the state 
administrative agency nor DHS documented their review and approval of the 
equipment purchase plans. Furthermore, the BZP template was not designed 
to capture such written reviews. G&T Preparedness Officers said that they 
reviewed only the equipment requested in the VRPP to assure that it was 
included in the Authorized Equipment List and listed in BZP section 8.4, 
recommended enhancements. 
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Without written documentation that the states and DHS have reviewed and 
certified the BZPP protective strategy and equipment request, DHS has no 
assurance that: 

• The BZP and approved equipment are coordinated with DHS' and the 
state's homeland security strategy goals and objectives, other 
programs, and funding sources; 

• Similar equipment has not or will not be acquired by responsible 
jurisdictions from another funding source; and 

• The equipment is the most appropriate for the identified site 
vulnerabilities. 

Program officials are taking steps to improve the BZP document submission, 
review, and approval process. For 2006, the state homeland security agency 
was required to provide a summary description of how the BZP supports state 
or urban area security strategies and national priorities, to discuss additional 
funding sources that leverage the implementation of the plan, and to list the 
target capabilities that it supports. This information is required for an 
assessment of each BZP's protective security strategy. For the 2006 BZPP, 
states that submitted VRPPs that were not initially approved received specific 
guidance from the G&T Preparedness Officer or IP reviewer as to why the 
plan failed. 

Equipment Selected May Not Target Site Vulnerabilities or Program Priorities 

When comparing the equipment identified in the BZP's recommended 
enhancement sections with equipment requested in the VRPPs, we could not 
determine why certain equipment was selected over other equipment types. In 
some instances, responsible jurisdictions could have selected equipment 
recommended in their BZP within the $50,000 cap and listed in one of the five 
suggested Authorized Equipment List categories but instead, chose equipment 
listed under other categories, such as personal protective, intervention, and 
operational and logistical support categories (see Appendix C). The BZP and 
VRPP submission process does not require responsible jurisdictions to 
prioritize needed equipment or document the reason for their selection of 
equipment, nor is the equipment review and approval documented by RMD. 

Responsible jurisdiction officials said that, given the large amount and types 
of equipment listed under each of the Authorized Equipment List categories, it 
was difficult to identify the types of the equipment best suited to address site 
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vulnerabilities. Many state administrative agency and other responsible 
jurisdiction officials described the equipment they requested as more 
response-oriented than prevention-oriented equipment. Examples of 
response-oriented equipment requested by responsible jurisdictions include 
command post-crime scene evidence collection vehicles, bomb response 
vehicles, total containment vessels, and bomb squad self-contained breathing 
apparatus equipment. Approximately 44% of the funded equipment in the 
four states was from categories other than the five suggested categories. 

Program managers said that when the selected equipment was not from the 
five suggested categories, it was more difficult to determine how the 
equipment matched the site protection goals of the BZP. Additionally, state, 
G&T, and RMD program staff said that they rarely questioned or denied 
equipment requested from outside the five suggested categories because 
responsible jurisdictions are in a better position to determine the most 
appropriate equipment. Perfunctory reviews and approvals of equipment may 
have resulted in equipment purchases unsuited to the BZP-identified site 
vulnerabilities or the BZPP program protective strategy. 

DHS describes BZPP as a targeted infrastructure protection program intended 
to supply security equipment matched to each BZPP site's specific protective 
strategy. However, authorizing essentially every equipment purchase from 
any Authorized Equipment List category, as was frequently the case for the 
2005 BZPP, increases the possibility that DHS expectations and responsible 
jurisdiction objectives will not be aligned. Rather than the highly targeted 
program envisioned by DHS, the equipment purchases we reviewed 
frequently lend themselves more to general terrorism detection or response 
efforts than to specific and tailored buffer zone protection strategies. 

Beginning in the 2006 BZPP, RMD required the responsible jurisdictions to 
select equipment from 12 pre-identified equipment categories considered by 
program managers to be the most appropriate for threat detection and 
prevention security strategies. The 12 allowable equipment categories are: 
Explosive Device Mitigation and Remediation Equipment; CBRNE 
Operational Search and Rescue Equipment; Information Technology; Cyber 
Security Enhancement Equipment; Interoperable Communications 
Equipment; Detection Equipment; Power Equipment; Terrorism Incident 
Prevention Equipment; Physical Security Enhancement Equipment; Inspection 
and Screening Systems; Agricultural Terrorism Prevention, Response and 
Mitigation Equipment; and Other Authorized Equipment. Only select 
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subcategories within the CBRNE Operational Search and Rescue Equipment 
category are eligible for FY 2006 BZPP funding. Focusing the BZPP grants 
on specific types of equipment will better support the protective goals of the 
BZPP program. 

Plans Do Not List All Equipment Required to Address Site Vulnerabilities 

Many responsible jurisdictions conducted thorough site vulnerability 
assessments during the development of their BZP. However, few completed a 
detailed list in BZP section 8.4 recommended enhancements of all the 
equipment necessary to enhance the protection of the CI/KR asset. We 
compared the BZP recommended enhancements with the corresponding 
VRPPs for the four states. Of the 412 BZPs, only 136 (33%) listed more than 
the equipment requested for funding in the purchase plan. The remaining 
67% essentially mirrored the equipment requested for funding in the VRPP. 
They did not identify the site's other recommended enhancements in the 
manner intended — as a means to determine all protective gaps and required 
resources, and to leverage other sources of assistance. Therefore, these BZPs 
cannot serve as a baseline for all the required protective measures and 
equipment needed for the buffer zone of the CI/KR site. 

RMD officials said that even though responsible jurisdictions were 
encouraged to list all enhancements needed to overcome buffer zone security 
gaps and shortfalls, they usually found it easier to provide information on only 
the equipment they were purchasing, versus all that was needed. Instructions 
in the 2006 BZP template section 7.6.13 encourages but does not require 
responsible jurisdictions to identify equipment, training, and capability 
enhancements beyond what is being requested. 

Equipment May Not Be Available to All Intended Sites 

Responsible jurisdictions have always had the option of batching several 
BZPP sites located within their jurisdiction under one VRPP. This enables 
jurisdictions to purchase a larger array of, or more expensive, equipment. 
Some large urban areas containing multiple BZPP sites consolidated ten or 
more sites under a single plan. 

According to program guidelines, equipment batched into one VRPP must 
reflect the specific needs identified in each associated BZP and be listed in 
each BZP's recommended enhancements section. However, the guidelines do 
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not require written certification that the equipment requested under a single 
plan will be available to and used at all of the sites. Without such 
certification, there is a concern that purchased equipment will not be available 
to all BZPP sites or will be used for purposes not intended by the program. 

We recommend that Under Secretary for National Protection and Programs: 

Recommendation 5: Require the Protective Security Coordination Division 
to certify: (1) that the equipment or resource enhancements requested in the 
VRPP are appropriate for the identified site vulnerabilities or the capability 
gap of the responsible jurisdiction; and (2) that the BZP approval is based on 
an analysis of the BZP plan's protective security strategy. 

Recommendation 6: Provide instructions in the BZPP application requesting 
that responsible jurisdictions include a complete description of all equipment, 
training, and capability needs necessary to protect the BZPP site or close 
capability gaps of the responsible jurisdiction. 

Recommendation 7: Provide instructions in the BZPP application requesting 
that responsible jurisdictions certify that all the equipment received will be 
available to all of the BZPP sites listed under the same Vulnerability 
Reduction Purchase Plan. 



Other Factors Affecting Program Administration 

Several other factors have affected program administration and contributed to 
the pace with which states have expended funds. First, neither DHS nor the 
states and responsible jurisdictions were well equipped to manage the very 
complex document development and submission process that evolved after 
DHS converted BZPP into a grant program. Second, applicants complained 
that DHS' suggested target assessment tool, while a key ingredient in their 
BZPP preparation, was too subjective, time consuming, and unreliable. Third, 
responsible jurisdictions complained of not receiving training in completing 
their BZP and VRPP documents. Finally, two DHS sub-components share 
responsibility for administering the program, particularly reviewing and 
approving the submitted BZP documents. Until recently, the sub-components 
had to coordinate these activities without the benefit of an automated system. 
This clouded roles and responsibilities of the sub-components when it came to 
grant decision-making, and confused applicants seeking the right DHS 
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officials who could answer questions about the BZP document development 
and submission process. 

The 2005 BZP and VRPP Submission Process Was Complex and Time 
Consuming 

With G&T assuming responsibility for management and distribution of the FY 
2005 BZPP funding awards, a complex BZP and VRPP submission process 
emerged (see Figure 4). The process left state and local governments 
confused and overworked. It entailed many responsibilities for DHS offices, 
state grantees, and responsible jurisdictions. RMD and G&T were required to 
coordinate efforts in order to move the process forward. 

The responsible jurisdiction drafts a BZP and VRPP for each site in its 
jurisdiction. It then submitted both plans to the state administrative agency 
for verification that the requested equipment complied with state homeland 
security strategies and did not overlap with other grant funding in the same 
jurisdiction. The state administrative agency would send the BZP documents 
to the G&T Preparedness Officer to ensure the requested equipment was 
allowable under the Authorized Equipment List. Once G&T approved the 
BZP equipment, it had to hand-carry the documents to RMD. RMD 
ascertained whether the data fields were complete. RMD logged the requested 
equipment into its database and notified G&T of its approval decision. G&T 
contacted the state administrative agency stating that the BZP and VRPP was 
approved and, subsequently, the state administrative agency notified the 
responsible jurisdiction to begin the purchasing process. 
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Figure 4: BZPP Grant Process 
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The 2005 BZP document submission, review, and approval process had a number 
of issues: 

• There was no clear BZP document submission deadline in 2005 and 
many responsible jurisdictions did not begin their BZP development 
until late summer or early fall of 2005. The average BZP and VRPP 
development and approval took 109 days from initiation at the 
responsible jurisdiction level to approval by RMD. While RMD 
ultimately waived all submission deadlines, as of March 21, 2006, 158 
BZPs had not yet been submitted to DHS and 656 remained to be 
approved and authorized for expenditure. 

• Initially some state administrative agencies were unaware of the 
requirement to prepare a VRPP for those BZPs previously submitted in 
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2004. This resulted in G&T rejecting plans and sending them back 
through the state office to the responsible jurisdictions. The 
responsible jurisdiction then drafted the BZP and VRPP and 
resubmitted them to the state office, further lengthening the BZP 
development, review, and approval process. 

• Mail and hand delivery of BZPs and VRPPs was necessary due to 
security concerns regarding the electronic submission of sensitive 
security information. For 2005, all BZPP documentation was placed 
on CDs and delivered through express mail. G&T activated an online 
secure portal for the 2006 process. 

• RMD subject matter experts were not carefully reviewing BZPs and 
VRPPs to determine if the plans were sound and the equipment 
appropriate. RMD is responsible for the subject matter review of 
BZPs and VRPPs, and holds the final approval authority for BZPs, 
funds, and equipment. 

In 2005, G&T Preparedness Officers informed the state administrative 
agencies of those CI/KR sites that DHS selected. In turn, the state 
administrative agency notified the responsible jurisdictions with protective 
security responsibilities for the sites. States became frustrated with the BZPP 
initiation process and lacked information on how to identify the appropriate 
responsible jurisdictions. In some cases, the BZPP site would have an address 
in one jurisdiction, but a neighboring jurisdiction would be responsible. One 
state official said that determining which responsible jurisdiction was 
responsible for the site was the most time-consuming part of the process. 

Once the responsible jurisdiction received the BZPP site list, they assigned the 
development of the BZP to a law enforcement officer, often in addition to the 
officer's regular duties. In some cities, responsible jurisdictions had a local 
homeland security unit that was responsible for the BZP, but these offices 
were usually composed of only two or three officers. In most cases, one or 
two law enforcement officers from the regular police force were responsible 
for conducting the vulnerability assessments, drafting the BZP, and 
developing the VRPP. On average, responsible jurisdictions needed 
approximately 200 hours over a 2- to 3-month period to complete one BZP. 
Larger facilities with more complex vulnerability assessments often required 
up to 300 hours to complete a plan. As we noted earlier, DHS recognized the 
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additional time requirements associated with developing BZPs and increased 
allowable management and administrative costs from 3% to 5% for 2006. 

In 2005, the absence of an automated grant system compounded issues related 
to the BZP submission process. Because the BZPP employed a paper- 
intensive process, states spent a significant amount of time trying to determine 
the status of BZPs already submitted to DHS. Many states said there was a 
lack of reliable real-time information or data. 

In 2006, DHS introduced a web-based system that enabled states to submit the 
BZPs and VRPPs electronically to DHS. This should enable DHS to track 
BZPs and VRPPs more easily. Presently, the system does not allow states or 
responsible jurisdictions to view the status of DHS' review of their plans. 

The Program Discontinued its Original Assessment Tool 

Another factor that contributed to the time responsible jurisdictions spent on 
2005 BZP development was the use of a target analysis tool — CARVER — 
developed by U.S. Army Special Operations Forces for mission planning and 
targeting an adversary's installations. The acronym CARVER stands for the 
six factors the military consider in the target analysis process: criticality, 
accessibility, recuperability, vulnerability, effect, and recognizability. RMD 
promoted its use as an assessment tool to help responsible jurisdictions apply 
a terrorist point of view and determine the components of a system or facility 
that terrorists would most likely target to attack. Responsible jurisdictions 
evaluated and scored their BZPP site's key components and assets — systems 
and subsystems such as power supply, fuel storage, and rail yards — against 
each of the six CARVER factors. Components and assets with the highest 
total scores were considered to be potentially the most vulnerable elements of 
the system. After prioritizing the list of targets at the site, the responsible 
jurisdiction identified the security measures required to prevent, protect, and 
respond to an attack. 

While having the status of only a suggested site vulnerability assessment tool, 
and with limited training, a majority of responsible jurisdictions employed the 
tool in the 2005 BZPP. Many described it as overly time consuming for the 
data it yielded, limited in its application, and not well suited to commercial 
facilities such as the malls, stadiums, office buildings, and theme parks that 
made up 46% of the 2005 BZPP sites. They determined that publicly 
accessed commercial sites typically have a larger number of potential threats 
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to analyze than other BZPP sites, resulting in very close scoring and difficulty 
in prioritizing. 

BZPP program managers also recognized the tool's shortcomings: one 
manager described it as "much too subjective," saying that "if ten people used 
it at the same site you could have ten different scores." In 2006, RMD 
determined that the tool was too problematic and removed it from the BZPP 
program package sent to responsible jurisdictions. Instead, RMD expanded 
the BZP template to gather additional site and local law enforcement capacity 
information for better gap analysis. The gap analysis identifies current 
capabilities on the site and in the surrounding area, and focuses on identifying 
the range of equipment and other resources required to address site 
vulnerabilities in general, rather than at specific site systems and subsystems. 

Training For Preparing BZPs Did Not Meet Demand 

To introduce responsible jurisdictions to the 2005 BZPP program, RMD 
program managers conducted training workshops and offered on-site technical 
assistance. The workshops offered site assessment training to local law 
enforcement and other prevention personnel, and prepared them to complete 
the BZP and Vulnerability Purchase Plan templates. Workshops often 
included more than one responsible jurisdiction and typically included a 
CI/KR site visit for training purposes. On-site technical assistance delivered 
additional support in the development of BZPs for specific sites. Between 
April 2004 and December 2005, RMD delivered 178 training workshops and 
135 technical assistance visits. 

Generally, responsible jurisdictions were satisfied with the content of the 
training workshop and technical assistance programs. However, not all who 
sought training received it. Program managers did not have a coordinated 
strategy to provide technical training and support to all the states and 
responsible jurisdictions participating in the BZPP. Instead, workshops and 
technical assistance visits were unevenly distributed across all BZPP sites and 
focused primarily on large urban areas. Some responsible jurisdictions were 
unaware of the technical assistance visits, while others said that support and 
training would have been helpful, but they were unable to get on the schedule. 
One training program participant observed that, within the initial 12 months of 
the BZPP program, it was evident that the program managers were 
overwhelmed by the demand and unable to respond to all requests. When 
program managers were unable to respond to all requests, some state 
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administrative agencies asked larger jurisdictions with the requisite staff 
knowledge and resources to train or assist smaller jurisdictions in their region 
to complete their BZPs. 

Limited Resources Have Affected Program Administration 

During our review, a majority of BZPP program staff was composed of 
contractors who provided continual support to G&T and RMD. G&T 
employed one part-time program manager and one full-time support 
contractor to process BZPs, while RMD employed one full-time program 
manager, three full-time support contractors, and one half-time support 
contractor to vet and approve BZPs (see Figure 5). DHS' reliance on 
contractors places the program in a delicate situation. RMD said that it had 
one contract to support the BZPP efforts, and should the contract be lost or not 
sufficiently cover the time and efforts of the contractors, the BZPP program 
would be hampered and possibly shut down. G&T experienced difficulty 
renegotiating a contract for one full-time contractor on BZPP. 



Figure 5: RMD- G&T Staffing 



Component 


G&T 


RMD 


Actual* 


1 Part-time Program Manager 
1 Full-time Contractor 


1 Full-time Program Manager 
3 Full-time Contractors 
1 Part-time Contractor 



*Responsible for 2006 BZPP and Chemical Sector BZPP Programs 



G&T said that even with contracted support, they did not have sufficient staff 
to run the BZPP. RMD said they had recently undergone a reorganization to 
maintain the resources necessary to successfully execute the program. 
However, changes within the 2006 BZPP, such as the decrease in eligible 
sites, the addition of a web-based application process, and inclusion of the 
Chemical Sector BZPP, make it difficult to determine appropriate staffing 
levels. 

In early 2005, RMD deployed 17 Protective Security Advisors (PSA) to assist 
local efforts to protect critical assets and provide a local perspective to the 
national risk picture. While the PSA program ultimately grew during 2005 to 
more than 60 field personnel in all 50 states, RMD did not deploy the advisors 
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in enough time to assist states with the 2005 BZPP. During 2005, the advisors 
served primarily as a contact for follow-up with states or DHS on the status of 
BZPs. The advisors said that they did not always receive the most up-to-date 
information on 2005 and 2006 program changes from RMD, and often 
received more current program information from their state-level contacts. 
Several advisors and state officials believed this was due to the limited 
number of full-time RMD and G&T staff assigned to the BZPP. RMD has 
described a more prominent role for PSAs which, given their regular 
communication with state offices and responsible jurisdictions, has the 
potential to enhance the program significantly. 

Today, the National Protection and Programs Directorate's Protective Security 
Coordination Division and FEMA's National Preparedness Directorate 
Capabilities Division share responsibility for administering the BZPP. Under 
their Memorandum of Agreement, the Protective Security Coordination 
Division serves as the subject matter expert in the development, review, 
implementation, and monitoring of BZPs, VRPPs, and site vulnerability 
assessment activities. It has the final decision-making authority for approval 
of BZPs and VRPPs. FEMA's National Preparedness Directorate Capabilities 
Division serves as the point of contact for state administrative agencies and 
assures programmatic and financial administration, monitoring, and 
processing of grant awards. This partnership has brought organizational 
stability to the BZPP program because of states' familiarity with grant 
personnel. But from the states' perspective, the BZPP does not have a single, 
responsible program official to provide guidance and feedback. The few 
dedicated staff it has are spread between two DHS components. States 
perceive the lack of staffing as the primary reason for delays in the review and 
approval process for BZPs and VRPPs. 

As the office primarily responsible for overseeing the department's grant 
programs, the National Preparedness Directorate's Capabilities Division is 
accustomed to having a large role in deciding grant awards. It possesses 
broad technical expertise and provides advice to states and responsible 
jurisdictions on equipment purchases. The Capabilities Division could 
streamline the review and approval process if it oversaw the contractor that 
currently reviews BZPs and VRPPs for the Protective Security Coordination 
Division. We are recommending that DHS consider this option. 
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We recommend that the Under Secretary for National Protection and 
Programs and the Deputy Administrator for the National Preparedness 
Directorate: 

Recommendation 8: Clarify roles and responsibilities of the National 
Protection and Programs Directorate's Protective Security Coordination 
Division and FEMA's National Preparedness Directorate Capabilities 
Division and amend the BZPP Memorandum of Agreement accordingly. 

Recommendation 9: Streamline the review and approval of BZPs and VRPPs 
by shifting responsibility for the review to FEMA's National Preparedness 
Directorate Capabilities Division. 

Recommendation 10: Increase the current allocation of resources to the 
BZPP so that sufficient staff is available to respond to applicant concerns and 
technical support needs during the BZP and VRPP development process. 

Recommendation 11: Provide state administrative agencies and responsible 
jurisdictions web-based access to the grants management system to monitor 
status of BZPs and VRPPs 

Recommendation 12: Provide Protective Security Advisors sufficient access 
to the grants management system so they may better assist states, state 
administrative agencies, and responsible jurisdictions to carry out the BZP and 
VRPP development and submission process. 
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Management Comments and OIG Analysis 

We evaluated DHS management's written response to our draft report, as well 
as information provided by grant and program officials since the exit 
conference, and made changes throughout the report. Based on this 
information, we have closed several of the report's recommendations. Below 
is a summary of management' s comments on the report recommendations and 
our analysis of them. For purposes of clarity, we split Recommendation 8 into 
two recommendations, with the latter becoming Recommendation 9. 

Since the draft report was issued and management submitted its written 
response, the offices managing this program have transitioned to FEMA and 
to a newly created directorate, the National Protection and Programs 
Directorate (NPPD). In March 2007, FEMA's Office of Grant Programs 
assumed responsibility for executing the BZPP grant program. The 
Preparedness Officers and BZPP program managers were transitioned to 
FEMA, specifically the National Preparedness Directorate's Capabilities 
Division. In March 2007, the Risk Management Division was reorganized 
into NPPD's Protective Security Coordination Division. Our report 
recommendations and discussion below reflect those changes. 

Management expressed concern that the OIG placed too much emphasis on 
the program's 2004-2005 startup years and did not sufficiently credit 
management for improving the program in 2006 and 2007. The OIG focused 
on BZPP since its inception to meet the objectives of our review specifically, 
to determine the efficiency of the process management used to identify BZPP 
assets and the adequacy of eligibility criteria used to determine investments at 
CI/KR sites. We completed our fieldwork in September 2006, which 
coincided with the conclusion of the 2006 BZPP grant awards and preparation 
of the 2007 program. We anticipated that our original recommendations 
would improve the 2007 grant program, however, management has taken 
action to address most of those recommendations. Accordingly, we 
highlighted corrections and ongoing improvements by program and grant 
officials throughout the report. 

Management also expressed concern that the OIG did not accurately convey 
programmatic goals and objectives. The report presents the program's 
objectives as originally conceived, and also reflects subsequent refinements. 
In 2004 and 2005, the purpose of the BZZP was to mitigate specific threats 
and CI/KR vulnerabilities. Program emphasis shifted in later years to increase 
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state and local capability to develop and implement homeland security support 
programs. 

Management attributed the slow delivery of equipment to procurement issues 
at the state and local level. We recognize that local procurement processes 
and procedures impact when equipment is made available to responsible 
jurisdictions. However, difficulties and delays in identifying sites and 
approving BZP plans during 2004 and 2005 were also factors. We modified 
the report to state that management now requires states to make BZPP funds 
available to responsible jurisdictions within 60 days of the VRPP approval 
notification. 

Recommendation 1: Verify all future BZPP site data with the applicable 
state homeland security or equivalent agencies and establish standard 
procedures for the state agencies to substitute BZPP sites. 

Management Comments: Management did not specifically address this 
recommendation in its formal response. 

OIG Analysis: In subsequent discussions of the draft report, BZPP program 
managers described the process employed at the state level in 2006 to develop 
initial Tier One and Tier Two site lists and to vet and validate these lists with 
state agencies. They described the expanded role that Protective Security 
Advisors now play in supporting this process. They stated that ad hoc 
substitution of sites during the execution of the program was not permitted in 
2006. 

Furthermore, the 2007 guidance, which describes the procedures for verifying 
BZPP site data with state and local agencies, is responsive to this 
recommendation. In addition, the use of the PSAs to assist states in vetting 
site lists will help ensure that BZPP site selection involves all necessary 
players. We concur with this information. 

Recommendation 1 is resolved - closed. 

Recommendation 2 (revised): Ensure that the BZPP grant guidance 
explicitly states that funding may be used to secure buffer zones surrounding 
federal facilities. 
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Management Comments: Management asked that the OIG delete the 
original recommendation to revise the 2007 BZPP grant guidance to stipulate 
that federal government sites may not receive BZPP funding, noting that if a 
nuclear power site or other high-risk site were federally owned, it would still 
be critical for the surrounding jurisdiction to be prepared. Funds would not be 
provided to the site or owner. Rather, consistent with the current BZPP 
structure, funds would be provided to the jurisdiction responsible for the 
safety and security of the community that surround the site. 

OIG Analysis: We agree that the original recommendation to revise the 2007 
BZPP grant guidance to stipulate that federal government sites may not 
receive BZPP funding would unnecessarily limit managements' ability to 
protect federally owned high-risk sites. Issuance of the FY 2007 BZPP 
Program Guidance and Application Kit in January 2007, with the prohibition 
that BZPP funds may not be used for the improvement of federal buildings or 
for other activities that solely benefit the federal government, is responsive to 
the issues we raised regarding federal facilities and the BZPP program. 

Based on our discussions with program managers, the Directorate's written 
response, and other actions taken, we have modified this recommendation. As 
written, program guidance may still confuse states and responsible 
jurisdictions regarding the inclusion of federal sites and we are recommending 
that the guidance be clearer. Management can satisfy this recommendation by 
acknowledging it will update next year's guidance and application kit. 

Recommendation 2 is resolved - open. 

Recommendation 3: Establish a deadline for processing all remaining 2005 
BZPP applications. 

Management Comments: Management suggested that the OIG modify this 
recommendation to state, "Do not process or approve any period of 
performance requests." As all 2005 applications have been processed, the 
deadline currently in place was the end of the period of performance for the 
grant - April 7, 2007. Due to the length of the state and local procurement 
processes, states may request extensions to this deadline so that they might 
effectively spend grant dollars. Management responded that it would 
reconsider this rephrased recommendation, noting that denying any potential 
and adequately justified request could have considerable negative implications 
for the Department. 
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OIG Analysis: We concur with management's response. Management has 
processed all 2005 applications and implemented a deadline for states to 
submit their FY 2007 BZPs. 

Recommendation 3 is resolved - closed. 

Recommendation 4: Continue expanding the involvement of all state 
homeland security agencies in the identification of potential critical 
infrastructure/key resource sites. 

Management Comments: Management did not specifically address this 
recommendation in its response. 

OIG Analysis: Program officials indicated during discussions of the report 
draft and in follow-up documentation that all state homeland security agencies 
were involved in the identification of potential CI/KR sites for FY 2007. 
Officials plan to make another data call to states to improve the quality and 
quantity of the Tier One and Tier Two site lists. 

We concur with these actions. Management can fully satisfy this 
recommendation by providing a copy of the methodology to be used in the 
upcoming data call to select, vet, and verify BZPP sites, as well as the results 
of the data call. 

Recommendation 4 is resolved - open. 

Recommendation 5 (revised): Require the Protective Security Coordination 
Division to certify: (1) that the equipment or resource enhancements requested 
by the responsible jurisdictions are appropriate for the identified site 
vulnerabilities or capability gap of the responsible jurisdiction; and (2) that the 
BZP approval is based on an analysis of the BZP plan's protective security 
strategy. 

Management Comments: Management responded that it has taken action to 
address this recommendation. In discussions of the draft report and follow-up 
documentation, program managers stressed that 2006-2007 BZPP program 
goals include closing the capability gaps of responsible jurisdictions. The 
2006-2007 BZP template requires the responsible jurisdiction to document 
how the equipment requested mitigates a site-specific vulnerability or a 
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capability gap of the responsible jurisdiction that has been identified in the 
BZP. 

OIG Analysis: We concur with management's response. We modified our 
report and this recommendation to reflect the new goals. The 2006-2007 BZP 
template requires the responsible jurisdiction to document how equipment 
funded with BZPP money mitigates a site-specific vulnerability or gap within 
the community and is appropriate. 

Management should provide documentation outlining the specific criteria used 
to analyze the BZP protective security strategies and the process to certify that 
the BZP meets those criteria. 

Recommendation 5 is resolved - open. 

Recommendation 6 (revised): Provide instructions in the BZPP application 
requesting that responsible jurisdictions include a complete description of all 
equipment, training, and capability needs necessary to protect the BZPP site 
or close capability gaps of the responsible jurisdiction. 

Management Comments: Management responded that in 2006 and 2007 it 
included instructions in the BZP template to guide responsible jurisdictions in 
the completion of BZPs. In discussions of the draft report, program managers 
stressed that 2006 and 2007 BZPP program goals include closing the 
capability gaps of responsible jurisdictions. Management indicated that it 
added additional instructions in the BZP template to guide responsible 
jurisdictions in the identification of all necessary equipment in the BZP. 

OIG Analysis: We modified the final report and reworded this 
recommendation to reflect the 2006 and 2007 BZPP program goals. 
However, the BZP template does not indicate that responsible jurisdictions 
should list all necessary equipment. Management can satisfy this 
recommendation by providing instructions in the BZPP application requiring 
that responsible jurisdictions include a complete description of all protective 
measures, equipment, and capability needs necessary to protect the BZPP site 
or close capability gaps of the responsible jurisdiction. 

Recommendation 6 is resolved - open. 
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Recommendation 7: Provide instructions in the BZPP application requesting 
that responsible jurisdictions certify that all the equipment received will be 
available to all of the BZPP sites listed under the same Vulnerability 
Reduction Purchase Plan. 

Management Comments: Management responded that it has taken steps in 
2006 and 2007 to ensure all requested purchases are coordinated with other 
on-going efforts, programs, and strategies within the region and state. 

OIG Analysis: Management's actions are responsive to the recommendation. 
However, the BZP template does not indicate that responsible jurisdictions 
should certify that all the equipment received will be available to all BZPP 
sites listed under the same Vulnerability Reduction Purchase Plan. 
Management can satisfy this recommendation by providing instructions in the 
BZPP application requesting that responsible jurisdictions certify that all the 
equipment received will be available to all of the BZPP sites listed under the 
same Vulnerability Reduction Purchase Plan. 

Recommendation 7 is resolved - open. 

Recommendation 8: Clarify the roles and responsibilities of the National 
Protection and Programs Directorate's Protective Security Coordination 
Division and FEMA's National Preparedness Directorate Capabilities 
Division and amend the BZPP Memorandum of Agreement accordingly. 

Management Comments: Management concurred that it should review the 
Memorandum of Agreement and consider changes as noted in the 
recommendation. In follow up discussions of the draft report, program 
officials stated that the purpose of the review would be to make adjustments 
based on the evolution of the BZPP and to reflect the reorganization of IP and 
G&T. 

OIG Analysis: We concur with management's response. Management 
should provide a copy of the revised MOA. 

Recommendation 8 is resolved - open. 

Recommendation 9: Streamline the review and approval of BZPs and 
VRPPs by shifting responsibility for the application's technical review to 
FEMA's National Preparedness Directorate Capabilities Division. 
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Management Comments: In its response to the draft report, management 
disagreed and stated that subject matter expertise for the site selection process 
and BZP review should reside within IP, which transitioned to the National 
Protection and Programs Directorate on March 31, 2007. In discussions of the 
draft report, program officials cited the possibility of a disconnect resulting 
from shifting infrastructure protection responsibilities out of the National 
Protection and Programs Directorate, and a corresponding lack of subject 
matter expertise within the FEMA's Capabilities Division. Program officials 
believe that the intent of the recommendation is to streamline approval of 
BZPs and implementing it would contradict that intent. 

OIG Analysis: The National Protection and Programs Directorate serves as a 
valuable resource in identifying BZPP sites and conducting training exercises. 
Our concern regarding the technical review stemmed from whether IP had 
sufficient resources to complete the reviews, its heavy reliance on contract 
support to review security plans, and the Office of Grants and Training's 
willingness and capability to perform this task. During our fieldwork, G&T 
officials acknowledged that their contractors could also perform this review 
and it would promote a cohesive and unified system to states applying for 
grants and result in consistency throughout the DHS grant processes. 

After we issued our draft report, program officials provided additional insights 
about the program applicable to this recommendation. The National 
Protection and Programs Directorate now has a cadre of approximately 68 
Protective Security Advisors to support the BZP submission and approval 
process. The PSAs participated in the 2006 and 2007 program. Directorate 
officials are confident that, by reducing the number of sites in 2007 to 
approximately 200, it will have a more manageable number of security plans 
to review and fewer resources will be required to review them. Finally, grant 
officials reconsidered their earlier comments that they could review BZPs, and 
reported that they believe the National Protection and Programs Directorate 
should perform this task. 

Based on these developments, Recommendation 9 is resolved - closed. 

Recommendation 10: Increase the allocation of resources to the BZPP so 
that sufficient staff is available to respond to applicant concerns and technical 
support needs during the application process. 
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Management Comments: The reduction of eligible BZPP sites from more 
than 1,800 in FY 2005 to approximately 200 in FY 2006 and 2007 will lower 
the grant office's administrative responsibilities and the amount of resources 
needed to support the program, review applications and security plans, and 
address any applicant concerns. Management will continue to monitor 
program resources and respond accordingly. Program officials also noted that 
the roles of the Protective Security Advisors have been expanded to assist 
with the program. 

OIG Analysis: We concur that the significant reduction in sites will reduce 
the technical and other support requirements of the BZPP, and that enhancing 
the role of the PSAs should mitigate execution problems encountered in FY 
2004 and FY 2005. Considering the decreased number of BZPP sites to 
process, we concur that the PSAs might provide adequate technical assistance 
to stakeholders. 

Recommendation 10 is resolved - closed. 

Recommendation 11: Provide state administrative agencies and responsible 
jurisdictions web-based access to the grants management system to monitor 
status of applications. 

Management Comments: Management disagreed with this recommendation, 
stating that this is not a feasible solution because neither IT solutions nor 
funding are in place. Furthermore, providing the jurisdictions access would 
not be consistent with other DHS grant programs. Management 
recommended that we delete this recommendation. 

OIG Analysis: Management responded that it is unable to act on this 
recommendation in the manner suggested. However, in discussions of the 
draft report, Directorate officials agreed that having a system capable of 
allowing states to monitor the status of the BZPs they submitted is a "good 
idea." Although we did not assess the technical limitations or lack of 
resources management noted, we recognize that expanded PSA support in the 
field will reduce the role headquarters staff play in meeting stakeholders 
informational needs during the BZP and VRPP development process. We 
encourage program managers to seek other practical solutions that respond to 
their stakeholders' need to stay abreast of the status of BZP submission 
documentation. 
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Recommendation 1 1 is resolved - closed. 

Recommendation 12 (revised): Provide Protective Security Advisors 
sufficient access to the grants management system so they may better assist 
states, state administrative agencies, and responsible jurisdictions to carry-out 
the BZP and VRPP development and submission process. 

Directorate Response: Management opposed the original wording of this 
recommendation, stating that the role of the PSA is not and should not be 
related to grants management, which is the role of the Preparedness Officer. 
Implementing the recommendation would only further confuse roles and 
responsibilities of the management personnel to the state and local 
representatives. Preparedness Officers are the primary points of contact for all 
grant-related questions. Additionally, PSAs do not have the grants experience 
or expertise to effectively address questions or issues related to the grants 
processes and program. Management recommended that the OIG amend the 
recommendation to indicate that PSAs should refer all grant questions to the 
appropriate Preparedness Officer. 

OIG Analysis: We recognize that Preparedness Officers are the points of 
contact for state agencies' inquiries on grant applications or BZP and VRPP 
approval status. We revised this recommendation to state more clearly that 
the PSAs support the BZPP and VRPP development and submission process. 
The intent of this recommendation is to ensure that the PSAs are adequately 
informed about the status of BZP plans so they might better assist responsible 
jurisdictions to bring submitted documents into compliance with program 
requirements. This is a PSA role that has been described by program 
managers. 

In discussions of the draft report, program managers stated that having a 
system capable of allowing PSAs to monitor the status of the submitted BZPs 
has merit, but will require additional resources to implement. We encourage 
program managers to seek other practical solutions that will allow the PSAs to 
be kept informed of the status of BZP submission documentation and to 
respond to their stakeholders' technical support needs. 

Recommendation 12 is resolved - closed. 
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Purpose, Scope and Methodology 



Our objectives were to determine the efficacy of the process used to identify 
BZPP assets and the adequacy of eligibility criteria used to determine 
investments at critical infrastructure and key resource sites. We examined the 
utility of the BZPs and VRPPs, and the extent to which authorized equipment 
purchases are designed to reduce vulnerabilities in areas surrounding CI/KR 
sites. We also reviewed future plans for the program. 

We took an in-depth look at the BZPP grant program activity in California, 
the District of Columbia, Georgia, Illinois, and Virginia. In these four states 
and the District of Columbia, we interviewed the officers of responsible 
jurisdictions that developed the BZPs, VRPPs, and grant application materials. 
We met with state homeland security agency and other state administrative 
agency officials in the five visited locations to discuss the BZP and VRPP 
development and submission process and follow-up. We interviewed G&T 
and RMD officials who manage the BZPP grants and distribute funds, and we 
met with National Protection and Programs Directorate staff working in the 
field with state and responsible jurisdictions. We also met with contractors 
who provide substantial support to the BZPP. We analyzed 412 BZPs and 
VRPPs submitted by California, Georgia, Illinois, and Virginia, and collected 
and analyzed data related to the equipment approval and purchasing process. 
Furthermore, we identified the current plans and future status of the BZPP 
program with relevant department officials. 

We conducted our review between March 2006 and September 2006 under the 
authority of the Inspector General Act of 1978, as amended, and according to 
the Quality Standards for Inspections issued by the President's Council on 
Integrity and Efficiency. 
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Management Response to Draft 
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I .S. l>i'|>jrtmeiil of U omcta ml Security 
Wiisiiinj-lort. DC 20528 



Homeland 
Security 



MEMORANDUM TO: 



Carlton [. Mann 

Assistant Inspector General for Inspections 



FROM: 



George W. Poresnian 
Under Secrelary 




SUBJECT: 



Response to Draft inspec tor General Report on the 
Review of the Buffer Zone Protection Program 



This responds to the January 30, 2007, memorandum requesting the Directorate lor 
Preparedness' comments on me draft Office of the Inspector General report, Review of the Buffer 
Zone Protection Program, First, we sincerely appreciate the opportunity to respond to the draft 
report. The attached document provides comments on the 1 1 recommendations directed to 
Preparedness. In addition, we arc providing some additional comments to clarify the Buffer Zone 
Protection Program described in the report. Questions concerning specific comments should be 
addressed to Duane Johnson at 202-447-3230. 

Please accept our thanks for the opportunity to respond to the draft report and to work with the 
Office of the Inspector General during this engagement. As Preparedness works toward refining 
its programs, the Office of the Inspector General's independent analysis of program performance 
greatly bene fits our ability to continuously improve our activities. We look forward to 
continuing this partnership in the future. 

Attachment 

CC: Robert Stepliau 
Corey G ruber 
Steven Pec i no v sky 
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Overall Comments 

As written, the report appears out of date and docs not adequately reflect the current Landscape 
(changes over the last 2 years) of the program. The report tends to focus on the FY 2005 
components of the program and docs not provide sufficient credit to the fact thai the current 
2006 and 2007 program is completely different and improves upon almost all issues noted in 
the report. As a result, many of the recommendations have already beeti addressed or arc no 
longer pertinent. 

As written, the report docs not accurately convey the program malic goals and objectives. 
I here appears |o he some misunderstanding regarding the intent and purpose of the program. 
Specifically, the BZPP is identified ljs a targeted infrastructure protection program which 
supports nation a I- Level Cl/KR protection priorities (NIPP Page 96). 

Throughout the document the term "application" is used incorrectly. 

o Application should refer to the time period when a grantee (a SAA in this 
program) has to apply for funds. This is prior to the award of funds. 

D This document uses the term application to refer to the period when a 

jurisdiction develops and submits Ei/PP program documentation (BZPs and 
VRPPs). 

o This is very misleading and we strongly suggest that it be corrected to refer 
to the "document development and submission process" rather than an 
1 \\p p I ica I i o if p recess/period . 

Specific Substantive and Technical Comments 

Page 1 : 

• /{ c y omm i 'm l< uf I i si linage Joi - Paragraph I ( f -tut nge$ in red) : KV flic [Suffer / o 1 1 e 
Protection Program (BZPP) supports the implementation of preventive and 
protective measures outside the perimeter of selected critical infrastructure and key 
resource (Cl/KR) sites throughout the United States. Buffer zone plans (BZPs) 
define supplemental security areas outside the Cl/KR site perimeter and recommend 
preventive and protective measures designed lo make it more difficult for terrorists 
to conduct surveillance or launch attacks. The BZPP provides funding to 

jurisdiction organizations lo purchase equipment to extend the /one of 
protection around Cl/KR facilities, expand preparedness capabilities, and enhance 
the security of surrounding communities." 

« In paragraph 2, the report discusses issues that slow the delivery of equipment to 
jurisdictions. However, the report docs not mention State and local procurement 
issues/processes as a reason. This has been identified as the primary reason it takes 
so long for jurisdictions to procure equipment, and this is backed up by data later in 
the report thai BZPs and VRPPs have been approved, but funds have nol been 
obligated. We recommend that this paragraph be modified to note State and local 

i 
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procurement issues/processes as the prevalent reason for the delay in acquiring 
equipment. This would fairly and more accurately depict the cause of the delays 
and not place iill the blame for slow delivery on DHS processes. 

Page 4: 

• "BZPP plan" should be "BZP " 
Page 5: 

• The rcporl m c n t io ti s eo o id i nat i ng \v ith Ihe "p re ven lion, det ec t i on , ai id d e terrei ic e 
mission areas of the National Infrastructure Protection Plan*' but there is no mention of 
coordination with prevention and protection mission areas of the National Preparedness 
Goal and its associated target levels of capability. 

• "Determining the allowable equipment" should be modi [led to "Determining allowable 
equipment and planning expenditures ." 

• "Submission acid processing of program materials" should be added to the list of issues 
that DHS has addressed since 2004. 

• Recommended language change (changes in red)' "Ihe program has identified 
common objectives, stimulated coordination of prevention and protection activities, and 
highlighted the skills and processes necessary to,.," 

Page 6: 

• "I low ev er, as of November 2006, approximately 79% of the $9 1 J million BZPP grant 
funds had not yet been expended on equipment for approximately 1,432 approved sites. 
Although program managers have initialed improvements in Ihe site selection and 
application process and have increased funding amounts available to each site, issues 
involving the strategic implementation and administration of the program remain. The 
strategic areas that DHS must continue to improve are the vetting of sites with Slate 
offices, timely expenditure of funds, and the selection of appropriate security 
equipment. Dl IS must also address the processing and approval of applications, 
communication between its sub-component s and with program participants, and the 
roles and responsibilities of those sub-components administering the program." 
Comment: This language should he modified to identify State and local procurement 
issues as a reason for delays. In addition it should he noted that in the 2006 and 
200? programs States are required to make funds available to the responsible 
jurisdiction within 60 days of the notification of approval of the VRPP. This is not 
noted in the report and addresses the identified issue. 

Page 7; 

• Recom mended langu age eh ange (ch anges in red) : 1 1 o w e v e i\ 1 he n cgol i at i on process 
was lime consuming, further delaying the 13/P and V RPP development and submission 
process. 

Page 8: 

• "The responsible jurisdictions we visited said that federal sites should be removed from 
the BZPP list because: (1) states do not have jurisdiction over federal property; (2) local 
jurisdictions arc often not the first emergency response units; and (3) local jurisdictions 
do not have ready site access to perform vulnerability assessments. Although RMD said 
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that federal government facilities were not included in the 2006 BZPP site selection, the 
2006 grant guidance is vague regarding the extent ihc BZPP program extends to federal 
government sites/* Comment: This language provides an in accurate interpretation 
of the program* Funds are not for facility owners/operators - federal or otherwise. 
Rather, funds are provided to support the implementation of preventive and 
protective measures by the jurisdiction responsible for the safety and security of the 
community that surrounds the identified site. Additionally, no site specific 
information (federal or otherwise) should be identified in grunt guidance. Thus, we 
recommend deleting the last sentence in this section. 

* "Some Preparedness Officers, as late as July 2006, did not know the final number of 
sites R Ml) had approved for their assigned states. One Preparedness Officer 
commented that since G&f had no reliable document a! ion on siles replaced or added 
by RMLX the only way to identify the applications still lo be submitted was by regular 
checks with the state homeland security agencies." Comment: The language above is 
the recollection of a single Preparedness Officer and does not reflect a n accurate or 
common picture. Preparedness Officers were cc'ed ami/or notified of all changes, 
and instructed to direct questions or requests for additional information to the GA T 
BZPP program manger antlfar liaison. We recommend that this section be deleted. 

* Recommended language change (changes in red): "There was no formal f*XP and 
VRPP submission (leadline established under the 2005, which resulted in additional 
delays in plan submissions." Comment: This was corrected in 06 and 07, but only 
issues with the 05 program are portrayed in the report, not the successful updates 
and changes. 

Page 9: 

* "Program managers established a maximum allocation of $50,000 per site for the BZPP 
program. 11 Comment: it should be mentioned that this was to ensure consistency 
with the legacy loan program initiated in 2004, therefore providing program 
consistency to the State and local jurisdictions. 

* "In addi t i o n, some s i tc owncr/op era tors w e re coi i eerii ed abo u 1 1 he ex c ban ge o f seeu ri ty- 
sensitive or proprietary business information. For instance, one state estimated that 30 
responsible jurisdictions from among the 89 selected siles did not want to participate 
and were ultimately replaced with other sites." Comment: P Ve recom mend 
mentioning 06 and 07 program updates that have addressed the exchange of security 
sensitive information. Under the 06 and 07 program, States may voluntarily submit 
information under PC 1 1. 

Pajje 10: 

* Recom m en ded langu age eh ange ( eh a nges in red) : the y a I so ae k ri o w I et I ged t b e 
amount of work required to complete site assessments and prepare RZP and VRPP 

submissions/* 

Page 1 1 : 
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• "Some have been wailing more than 2 years for Dl IS to approve their 2004 BZPP grant 
a pp I i c at ions." Com merit; This is facta ally in correct as tit ere was no 2004 BZPP 
gram program. 

• We strongl y cncon rage the re-ex a m i na lion o f Re co ni men da t io n 2 and rie I et i o n I rem 
Ihc final report. If a nuclear power site or other high risk site were federally owned, it 
wo a kl su 1 1 be eri I i ea I lb r th e sit r ro n i id i ng j u r i sd i c t i o n t o he prep ared . F u nd s wo a Id i ui t 
be provided to the site or ow ner, Rather, consistent with the current BZPP structure, 
hinds would be provided to the jurisdiction responsible for the safety and security of 
the community that surrounds the site. 

• It is recommended that Recommendation 3 be rephrased to state "Do not process or 
approve any period of performance requests," As all 2005 applications have been 
processed, the deadline currently in place is the end of the period of performance for 
the grant April 1, 2007. Due to the length of the Slate and local procurement 
processes, States may request extensions to this deadline so that they may effectively 
spend the grant dollars. DHS would lake this rephrased recommendation under 
consideration, noting that denying any potential and adequately justified requests could 
have considerable negative implications for the Department. 

Page 13: 

• "Many Tier One and Tier Two sites are chemical facilities. Dl IS is the sector specific 
agency responsible for securing the chemical sector. Due to the high risk nature of this 
sector and Ihc need to focus resources directly at it, DNS created the Chemical Sector 
Buffer Zone Grant Program. For 2006, Dl IS is providing an additional S25 million to 
mitigate vulnerabilities at all Tier One and Two chemical sector sites. Specifically, this 
program will provide approximately SI 89,000 per site for equipment purchases, 
RMD's decision to create the program was prudent. By removing these sites from Ihc 
general RZPP. DEIS ensured additional funding for general BZPP sites. DHS will be 
better able to coordinate its resources to protect chemical sec lor sites/' Comment; 
Parts of this paragraph are fact a ally incorrect. Chem-BZPP funds were not 
awarded to sites, hut rather to States for use within the DHS identified chemical 
regions. The $189,000 meutioned was awarded to a discretionary site under the FY 
2006 BZPP, not the Chem-BZPP. 

Page 1 6: 

• "Without written documentation that the slales and DHS ha\e reviewed and eeriillcd 
the BZPP protective strategy and equipment request, Dl IS has no assurance that: 

o '[ he BZPP plan and approved equipment arc coordinated with DHS 7 and the 
slate's homeland security strategy yoals and objectives, other programs, and 
funding sources; 

o Similar equipment has not or will not be acquired by responsible jurisdictions 

from another funding source; and 
o The equipment is the most appropriate for the identified site vulnerabilities. 
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Program officials arc taking steps to improve the BZPP application review and 
approval process. For 2006, the slate homeland security agency is required to provide a 
summary description of how the BZPP plan supports state or urban area security 
strategies and national priorities, to discuss additional funding sources that leverage the 
implementation of the plan, and to list the target capabilities that it supports. This 
information is required for an assessment of each BZPP plan's protective security 
strategy." Comments: DlfS offers the following comments* 

o DHS approval of ail VRPPs is documented on the form itself States who 
submitted VRPPs that were not initially approved received specific guidance 
via e-mail from the G& T Preparedness Officer or IP reviewer as to why the 
plan failed. 

a The above has been farther addressed in 06 and 07 with a standard template 
for DlfS (G& T and IP) to capture the review of each H/P and VRPP (this 
was provided to IG staff). The State mast also document its review und 
approval of the plan. 

o The report emphasizes issues that have been addressed and changed and 
which are no longer an issue. 

Page 17 18: 

Recommended language change (changes in red): "However, authorizing essentially 
every equipment purchase from any Authorized Equipment List category, as was 
frequently the ease for the 2005 BZPP, increases the possibility that DHS expectations and 
responsible jurisdiction objectives will not he aligned. Rather than the highly targeted 
program envisioned by LUIS, the equipment purchases we reviewed frequently lend 
themselves more to general terrorism detection or response efforts than lo specific and 
tailored buffer /one protection strategics. However, DHS took action to correct this 
problem by limiting allowable equipment under the 06 and 07 programs, which was tightly 
focused on prevention and protection related equipment. This ensured that program 
expenditures support the goals and objectives of me overarching program." 

Page l l >: 

* "1 lowever, the guidelines do not require written certification that the equipment 
requested under a single plan will be available to and used at all of the sites. Without 
such certification, there is a concern that purchased equipment will not be available to 
all BZPP sites or will be used for purposes not intended by ibe program " Comment; 
This has been corrected by ensuring that States certify requested expenditures in the 
VRPP are coordinated with overarching State homeland security strategies and other 
funding sources. 

* Corrective actions to implement Recommendation 5 were instituted during the FY 
200f> und 1 ; Y 2007 programs. The f'V 2006-21)07 template specifically requires the 
responsible jurisdiction to document how the equipment requested specifically 
mitigates a site-specific vulnerability or a capability gap of the responsible 
jurisdiction(s) that has been identified within the BZP. 
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# Edits in red: "Recommendation f> i P ro vide instructions in the H/T thai in form 
responsible jurisdictions to respond to RZP section 8.4 with a complete description of 
all protective measures necessary to protect the BZPP site." 

• Recommendation 6: Steps have been taken under the 06 and 07 program to implement 
this recommendation by including language in the BZP template to guide responsible 
jurisdictions in their responses. 

• Edit in red: "Recommendation 7: Provide instructions in the requesting that 
responsible jurisdictions certify that all the equipment received will be available to all 
of the BZPP sites listed under the same Vulnerability Reduction Purchase Plan." 

* Recommendation 7: Steps have been taken under die 06 and 07 program to ensure all 
requested purchases are coordinated with other ongoing efforts, programs, and 
strategies within the region and the Slate, 

Page 20: 

# Many of the issues identified in paragraph I have been overtaken by events as the 
problems have been corrected. 

# Recommended language correction (correction in red): 'The 2005 BZP mid VRPP 
subm ission Process Was Complex and Time Consuming" 

# Throughout the next two pages application is used incorrectly (Recommended 
language correction (correction in red): 

o "a complex BZP and VRPP submission process emerged..." 

o "The BZP and VRPP submission and review process entailed many 

responsibilities forDHS ol'liecs. slate grantees, and local jurisdictions. RMD 
and (i&T were required to coordinate efforts in order to move BZPs and VRPPs 
forward. 

Page 22: 

* Recommended language change (change in red): "There was no clear application 
submission deadline for BZPPs in 2005. However, clear submission deadlines were 
identified as part of the 06 ami 07 process." 

Page 23: 

• Recant m en ded fa tig it age change (change in red) : "Mail and hand delivery of BZPP 
applications was necessary due to security concerns regarding the electronic submission 
of sensitive security information, for 1005. nil EJZfT information was placed on CDs 
and delivered through express mail Further improvements were instituted for the 06 
and 07 processes through the use of the online G&T Secure Portal." 

• "Slates became frustrated with the BZPP initiation process and lacked information on 
how lo identify the appropriate local jurisdictions. In some cases, the BZPP site would 
have an address in one jurisdiction but a neighboring jurisdiction would be 
responsible." Comment: Steps have been taken to ensure appropriate jurisdictions 
are identified through coordination with the DifS PSA. 

6 
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o Once I he responsible jurisdiction organisation received ihu BZPP site list, Ihcy 
assigned the development of the BZPP plan to a law enforcement of fleer, often 
in addition to the officers' regular duties. Comment'. DIfS recognized the 
additional time requirements associated with developing and implementing 
the BZPP. Therefore, allowable management ami administration eosts 
(including backfill and overtime) were allowable in the FY 2005 program. 

Page 24: 

• Recommended language change (changes in red): "In 2006, 1)1 IS introduced a web 
based submission system. This system will enable stales to submit the BZPs anil 

e I ec 1 1 on ically to DHS f b r rev i ew , i nc 1 ud i ng t he BZPP pla n and V u Inedibility 
Reduction Purchase Plan [breach site. This should enable DHS to track BZPs and 
VRPPs more easily, However, it will not allow stales or responsible jurisdictions to 
view the status of submitted applications." 

Page 26: 

• "While renegotiations took place, states did not have a dedicated point of contact at 
G&T " Comment; This is not correct as all States have a full time preparedness 
officer dedicated to their State as the primary POC. 

Page 28: 

• Recommendation 8: We concur that the MOA should be reviewed. The 
recommendation can be considered upon review of the MOA. However, currently 
subject matter expertise for the site selection process and BZP review should reside 
within IP. 

• Recom m ended language change f eh anges in red ) : " Re co m in e n d at ion 9 : H xam i nc 

the current allocation of resources to the BZPP, Ensure that sufficient staff is available 
lo respond to applicant concerns and technical support needs during the BZP and VRPP 
submission and review process.' 1 

• Recommendation 4 J: The reduction of (he number of eligible BZPP sites from over 
1,800 in FY 2005 lo approximately 200 in each of FY 2006 and 2007 will significantly 
reduce the constraints on G&T resources to support the program, its review process, 
and the ability to address any applicant concerns. However, this recommendation will 
be monitored and addressed, as deemed necessary, 

• Recommendation 10: This is not a feasible solution, as neither IT solutions nor 
funding are in place to implement this, nor is this ability available under other DHS 
grant programs. We recommend that this recommendation be deleted from the report. 

Recommendation LI -DHS strongly opposes this recommendation . 1 he role of the PSA 
is not and should not be related lo gi ants management. That is ihc role of the G&T 
Preparedness Officer. Allowing this would only further confuse roles and responsibilities 
of DHS personnel to the State and local representatives. POs are the primary POC for all 
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grant related questions. Additionally, PSAs do not have the grants experience or expertise 
to effectively address questions or issues related to the grants processes and program. This 
recommendation must be amended to identify that PSAs should refer all grant questions to 
the appropriate POs, 



Sensisitivity Concerns 

G&T has no concerns regarding sensitivity. 
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Equipment Selection Comparison 











Equipment 


Equipment Listed in BZPP Recommended Enhancements 
(Sec. 8.4) 


Requested in 
VRPP 


ITEM 


QUANTITY 


UNIT 
PRICE 


TOTAL 




Enhanced security light 
svstpm 


1 


$500,000 


$500,000 




Enhanced security 
CCTV camera svstem w/ 
anomaly based software 


1 


$1M 


$1M 




R alii stir resistant trash 
containers 


100 


$1 000 


$100 000 




Protective fencing 
systems w/ screening 


2 


$4,000 


$8,000 




Electronic access control 
system 


1 


$10,000 


$10,000 




Intrusion detection 
system 


1 


$10,000 


$10,000 




Chemical/biological 
detection system 


1 


$100,000 


$100,000 




Anti- vehicle bollard 
system 


1 


$50,000 


$50,000 




Night Vision Scope 


1 


$9,386 


$9,386 


X 


Explosive storage 
magazine 


1 


$7,000 


$7,000 


x 


Small explosive 
magazine day box 


1 


$800 


$800 


X 


Tactical entry helmets 


60 


$137 


$8,243 


X 


Tactical entry nape pads 


60 


$19 


$1,144 


X 


All-terrain CBRNE 
vehicle 


1 


$8,460 


$8,460 


X 


Equipment trailer 


1 


$1,295 


$1,295 


X 


Digital cameras 


5 


$2,000 


$10,000 


X 


Camcorders 


4 


$350 


$1,400 


X 


CBRNE Gas Mask Filters 


25 


$24 


$600 


X 


Gas Mask Bags 


25 


$24 


$600 


X 


Gas Mask Adapter 


25 


$24 


$600 


X 


BZPP Total: $1,827,528 


VRPP total: 
$49,528 
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William McCarron, Chief Inspector, Department of Homeland Security, 
Office of Inspections 

Jim O'Keefe, Senior Inspector, Department of Homeland Security, Office of 
Inspections 

Megan McNeely, Inspector, Department of Homeland Security, Office of 
Inspections 
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Department of Homeland Security 

Secretary 
Deputy Secretary 
Chief of Staff 
Deputy Chief of Staff 
Executive Secretary 

Assistant Secretary for Legislative and Intergovernmental Affairs 
Assistant Secretary for Public Affairs 
Assistant Secretary for Policy 

Deputy Under Secretary for National Protection and Programs 

Assistant Secretary for Infrastructure Protection 

General Counsel 

Chief Security Officer 

Chief Privacy Officer 

Management OIG Liaison 

National Preparedness Directorate Audit Liaison 

National Protection and Programs Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 
Management Program Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as appropriate 
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Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 
(OIG) at (202) 254-4199, fax your request to (202) 254-4305, or visit the OIG web 
site at www.dhs.gov/oig. 



OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of 
criminal or noncriminal misconduct relative to department programs or 
operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, Attention: 
Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller. 



